Release Readiness, independently verifiable
Point Comreadiness at any repository. In under an hour it returns an evidence-backed Release Readiness Index: every finding cited to the line, every control attested, and the verdict sealed in a certificate any counterparty can independently verify.
The same evidence trail answers a different question depending on where you sit: buying, building, or accountable for the result.
A first-pass technical screen on any target's GitHub, before you spend a partner's afternoon or an advisor's invoice on it.
Run the same assessment an acquirer would on your own codebase. Fix what matters before the partner meeting; ignore the rest with receipts.
Engineering, security, and platform leads get an objective, repeatable read on readiness, with the evidence to back every number when someone pushes.
We instrument the technical-readiness portion of diligence so the partner spends their hour on the founder, not the codebase.
Install the read-only GitHub connector (Personal Access Token, scoped to read). Link one repository or an entire organisation. We never clone or publish your source. Only bounded evidence excerpts are kept (never your full repository), and they're deleted with the assessment. Revocable in one click.
Read moreWe run 500+ deterministic rules and up to 30 AI specialist agents against the framework you choose. Every finding cites a control code; code-pattern findings additionally cite a file location (with a line range when the agent can pinpoint it). The rule layer is fully reproducible run-to-run.
Read moreInvestor-grade report with executive summary, maturity matrix, blocker queue, and remediation workbook. Generate the signed Release Readiness certificate and share its public verify link, so anyone can check it's authentic without touching your code. Re-run quarterly to track movement against itself.
Read moreReal product screens from a live assessment of a sample organisation, not mockups.
A completed run shows the overall score, evidence collected, and every finding grouped by severity, from release-blocking criticals down. Each finding cites the control it failed and, for code patterns, the file behind it.
Ten weighted domains roll up into one certificate, but must-pass gates cap the certified tier, so a high average with a live blocker still reads Not Release Ready. Controls a machine can't verify (DR tests, pen tests, IP assignments) are covered by recorded human attestations, kept distinct from machine-verified evidence.
Every certificate carries a public verify link. The page recomputes the result from the signed inputs and checks the signature; edit a single displayed figure and verification fails. Share it with an investor, acquirer, or board without giving them access to anything else.
Most tools generate output. We narrow it. Each framework is a structured rubric of controls, run by specialist agents against real evidence. Modular rule packs by language, framework, deployment target, or compliance regime.
| № | Framework | Lens | Scope |
|---|---|---|---|
| FW.01 | Technical Due Diligence Architecture · Documentation · Testing maturity | Investor / acquirer | 26 controls |
| FW.02 | Commercial SaaS Packaging · Onboarding · Multi-tenant isolation | Launch readiness | 102 controls |
| FW.03 | Enterprise Release Governance · Rollback · Operational resilience | Deployment readiness | 24 controls |
| FW.04 | Security Baseline IP & licensing · Secrets · Authorisation | Posture & provenance | 19 controls |
Every tool in this category publishes a coverage number. Almost none publish how strongly each control was actually examined, which is the first thing a diligence lead asks. Each of our controls carries one of three assurance levels, and the level is set by what the check genuinely does.
The configuration or the repository's own measured history is read directly. If the control is absent, that absence is a real finding, not an inference.
Deployment and container configuration, release and maintenance history, contributor concentration.
A strong signal in source, flagged for review rather than asserted. These checks can miss things, so they say so: they carry reduced confidence and are routed to human review instead of quietly moving a score.
Code-level security patterns, language and framework conventions, project-type expectations.
A document or configuration references the control. That evidences the subject was considered. It does not evidence the control is implemented, and it is excluded from the automated score for exactly that reason.
Certification-style clauses that require human attestation, such as governance and privacy commitments.
Every control the platform runs is attributed to the standards a buyer, auditor or acquirer will ask about, so a finding arrives with the clause it belongs to rather than as an opinion.
| Framework | Focus | Controls |
|---|---|---|
| ISO 27001:2022 | Annex A controls reachable from source | 363 |
| NIST SSDF (SP 800-218) v1.1 | The software development lifecycle framework | 300 |
| CIS Controls v8 | Application security and configuration | 143 |
| SOC 2 Type II | Trust services criteria | 89 |
| NIST CSF 2.0 | Identify, protect, detect | 75 |
| OWASP ASVS 4.0 | Verification requirements | 19 |
| CIS Docker Benchmark | Container image and runtime hardening | 8 |
| CIS Kubernetes Benchmark | Pod security and workload isolation | 7 |
| AWS Well-Architected Security Pillar | Cloud infrastructure declared in IaC | 7 |
| Microsoft Cloud Security Benchmark | Azure infrastructure declared in IaC | 6 |
| CISA SBOM Minimum Elements (2026) | Software bill of materials, the EU CRA baseline | 4 |
A control can map to more than one framework, so these do not sum to the total. Every control carries an assurance level and coverage is reported split by those levels in the product, so a figure is never quoted without saying how strongly it was checked.
Restraint is the feature. Tools that promise everything decide nothing. We compress the technical-readiness portion of diligence and stop there. Knowing where the line is is what makes the signal worth trusting.
A single model has a single bias. For a decision this consequential, run a panel: several LLMs assess the same evidence independently, and we reconcile them. Agreement is signal. Disagreement is where the real questions live.
Models agree the architecture is sound; they split on tenant isolation: GPT-5 flagged it a blocker, the others did not. The evidence (a shared DB schema with no row-level scoping) supports the stricter call. Verify before launch.
Illustration of the panel flow, not live output.
Pick the models: the latest managed Anthropic and OpenAI frontier models, or bring your own key (BYOK) for Gemini, DeepSeek, Mistral, or a self-hosted endpoint. Each one scores the same evidence on its own.
We line the verdicts up: where the models agree you can move; where they diverge, whether that is a score gap, a disputed blocker, or a finding only one model saw, we surface it precisely.
A final pass rationalises the disagreement: why the models differ, which call the evidence best supports, and the next step to settle it. The result is one reconciled verdict you can defend.
If the evidence shows your code was predominantly built with one vendor's model, the AI review runs on the other vendor's: code written with Anthropic models is examined by an OpenAI model, and vice versa. When attribution is ambiguous or the counter-model isn't available, the run says so instead of pretending.
Managed models run under your plan's cost cap. Bring-your-own keys are encrypted at rest and run on your own quota, including private, self-hosted models for sovereign deployments.
Everything on the left runs today and shows up in an assessment you can execute yourself. Everything on the right is decided and not built. We keep the two lists separate because a roadmap that quietly absorbs the shipped column is how software gets sold twice.
Whether a bill of materials is produced at all, whether it describes what actually ships rather than what the manifests intended, whether releases are signed, and whether the components underneath are genuinely pinned. Aligned to the 2026 minimum elements published by CISA with seventeen international partner agencies, which the EU Cyber Resilience Act already makes a commercial requirement.
A bill of materials says what is in the release. Provenance says how it came to be, which is what lets a customer confirm the binary they received corresponds to the source they were shown.
The files being changed most, cross-referenced with who is changing them, whether they are tested, and whether they sit in security-sensitive territory. The output is not a metric, it is a sentence about a specific file: this one changes constantly, one person understands it, and it handles authentication.
Whether review is required and enforced for everyone including administrators, whether approvals survive later changes, whether ownership is defined for the areas that matter, and whether the review queue is keeping up. Configuration audits report that review is enabled. Enabled is a weaker claim than enforced.
Where a repository already runs deeper analysis, its results are ingested and scored rather than ignored or duplicated. Reimplementing that badly would be an expensive way to be worse.
Not how much of the code was AI-assisted, which we already reported, but what the running product depends on: whether the model dependency is declared anywhere, whether its version can change underneath you, whether untrusted text can reach it, and whether the calls are bounded in cost and time.
Java and Spring, C# and .NET, PHP and Laravel, Ruby and Rails, and Rust join Python, JavaScript and Go. A generic scanner finds generic problems. These read each ecosystem's own failure modes: what deserialization means in Java, what unserialize means in PHP, and for Rust the questions that actually apply once memory safety is the default, including whether the advisory database is ever consulted at all.
Where an assessment finds a required artefact missing, 26 production-grade files are available to close it: security policy, disclosure process, CI and release pipelines, architecture and setup documentation, operational runbook, incident response, disaster recovery, data retention. Telling a founder their runbook is missing is worth less than handing them one.
Today an assessment starts here. It should be able to start from a pull request in your repository, or from a command line, without an account existing first. That is the next piece of work.
Several of the newest checks read signals that only one provider currently exposes. Where a signal is unavailable the control reports as unassessed rather than passing, and closing that gap is queued.
Signed, published build outputs so a recipient can verify integrity without taking our word or yours for it.
Model behaviour testing sits beyond what static evidence can reach today. It is on the roadmap, and it is not claimed anywhere in the product until it exists.
Every assessment ships distinct deliverables, each built for a different audience: partners, founders, engineers, LPs, auditors. All of it led by a signed, independently verifiable certificate.
A signed Release Readiness certificate with a public verify link. An investor confirms the score is authentic and untampered without re-running anything, and it can't be doctored after the fact.
A full software bill of materials with every dependency's licence classified as permissive, copyleft, or prohibited, so GPL/AGPL contamination surfaces before a deal does, not after.
How much of the codebase shows AI-authorship signals, and whether that AI use is governed. The provenance and IP question every 2026 acquirer now asks.
Contributor concentration and bus-factor analysis from commit history: how much of the codebase only one person understands, before that person resigns mid-diligence.
One page. Board-ready. Plain English score, the three things to fix, the three things working.
Quick wins and effort estimates. The list a CTO can hand to their team on Monday morning.
Every finding in full: severity, file path, the evidence behind it, and the standards clause it maps to. The detail an engineer needs to disagree with us, which is the point.
The findings rewritten as instructions a coding agent can execute, with the fix templates inlined. Hand it to Claude Code or Cursor instead of re-typing the workbook.
Who ran what, when, and against which commit, plus a processing record for every assessment. Prompt content is never stored. This is the artefact an auditor asks for.
The whole assessment as JSON: scores, findings, evidence and control attribution. Drop it in a data room or pipe it into your own reporting.
Not just the score. The gates currently capping your tier, the point gap, and the domains ranked by how much closing them would move it.
The certificate, gates, domain scores, remediation path and licence appendix on one printable page, with the public verify URL on it. Print to PDF and attach it to the data room.
Every artefact is saved to the report library, so a deliverable can be re-opened and re-exported later without re-running the assessment.
Read-only GitHub connector. We never clone or publish your source; we retain only bounded evidence excerpts (capped per file and per repository), deleted with the assessment.
Your code and findings are never used to train AI models, ours or the providers'.
Every finding cites a control; code-pattern findings cite a file location (with a line range when the agent can pinpoint it). No opaque AI scores.
I'm Jason Agnew. I run Belton IT Nexus, a New Zealand managed IT and cyber-security company, and I've spent years on the technical side of deals watching the same thing happen: good teams walk into due diligence blind. The first time they see their codebase through an acquirer's eyes is when a deal or a raise is already on the line, and by then every surprise is expensive.
Comreadiness is the check I wanted to hand them months earlier: what a buyer would find, with the evidence to back it, and a certificate anyone can verify without taking our word for it.
Three subscription tiers, plus Sovereign on the roadmap: a BYOC (bring your own cloud) deployment for environments where source can't touch a third-party LLM. Pricing isn't released yet; waitlist members see launch pricing first. AI cost is BYOK today: bring your own Anthropic or OpenAI key, capped per assessment so spend stays predictable.
Solo angels & scouts · BYOK
Pricing at launch
Get started — freeFunds & family offices · BYOK or managed
Pricing at launch
Get started — freePE, multi-fund, M&A · all managed
Custom · scoped per engagement
Get started — freeBring any repository you have read access to. We'll run a live assessment with you. We won't be the loudest tool in your inbox. We'll be the one that earns the second meeting.